Analysis
-
max time kernel
3s -
platform
windows11-21h2_x64 -
resource
win11-20250313-en -
resource tags
-
submitted
01/04/2025, 17:34
General
-
Target
ENG.exe
-
Size
274KB
-
MD5
19178c984d2b0cd1892184d49e1fe363
-
SHA1
aebbd3bc04139710060e7ebc2d1b4dc1fdb3ab0b
-
SHA256
3b9ec63de654a60c5daf67e8be68c8b99e0df5f7d52948f953a6f73745419879
-
SHA512
4e9dc1df719f233509d86c9a1174bf0c62c8902cbc370df2ec5f688df7bdaac0d42de669b7980541afe108a8a1f11a512d713ec8b3fc9c39fa815b96ea7930fb
-
SSDEEP
6144:PFc2dmBAWN/ccQEU9euYg7XCOiQ04eA61CIjjibEjKpm7oS:PFc2A3ecQEU9euYuXCOiQWHkIjjX2m7Z
Score
10/10
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 1 IoCs
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
-
Indicator Removal: Clear Persistence 1 TTPs 1 IoCs
remove IFEO.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Control Panel 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ENG.exe"C:\Users\Admin\AppData\Local\Temp\ENG.exe"1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Indicator Removal: Clear Persistence
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
944KB
-
Filesize
64KB
-
Filesize
36KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
944KB